Repository navigation
feat: Appwrite 2.6.2, and fix the upstream drift check - #30
Merged
Merged
Conversation
The check moved to gcrunner in #18, whose image has no PHP, so `make env-defaults` failed with "php: not found" on 2026-10-26 after finding Appwrite 2.6.2, and no issue was opened. setup-php 2.40.0, pinned by SHA like the other actions, with PHP 8.4 and no extra tools.
- appVersion 2.6.2, a security release (appwrite/base 2.2.7 for Brotli CVE-2026-111497; API key, realtime, GraphQL, storage, VCS and outbound request hardening). Migration V25 as 2.6.1, so no schema change. - The images its docker-compose.yml uses: console 1.2.108-self-hosted (DOMPurify 3.4.17), browser 0.3.8, ExifTool 0.1.1. Orchestrator 2.2.4 and executor 1.1.2 are unchanged; Orchestrator 4.0.0 waits for Appwrite 2.7. - files/env-defaults.yaml regenerated: _APP_MEMORY_LIMIT (512M) is new. production.md says when to raise it. - The render refuses compute.secrets.orchestratorSecret=your-secret-key, which 2.6.2 rejects for job callbacks. The generated default is random. - Docs: project and messaging SMTP and migration sources now follow _APP_ALLOWED_INTERNAL_ADDRESSES; the console offers Entire without a feature flag (appwrite/appwrite#14896); 2.6.2 wherever a version is named. - compose's new appwrite-imports mounts and _APP_DNS on more workers need nothing: every pod gets the shared env and the imports volume already. - CI upgrades from the published chart 2.1.0 (Appwrite 2.6.1).
🟢 Tier S · Ready to merge
Updates the chart and its documentation, examples, and CI references for Appwrite 2.6.2, including bundled component pins and the new PHP memory default. Adds render-time validation for Appwrite's placeholder orchestrator secret, and fixes the upstream drift workflow by setting up PHP before generating environment defaults. The install upgrade scenario now starts from published chart 2.1.0. Latest changes: The latest commits make placeholder-secret validation honor
📂 Walkthrough · 25
✅ Fixed since the last review · 1
Reviewed the commits since |
![hansi-codes[bot]](https://avatars.githubusercontent.com/in/5046327?s=60&v=4){kind=small}
…s set _APP_JOBS_SECRET then comes from that Secret and orchestratorSecret is ignored, so a leftover placeholder there mustn't fail the render. From review on #30.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Appwrite 2.6.2 (release notes) is a security release:
appwrite/base2.2.7 patches Brotli (CVE-2026-111497), and it hardens API keys, realtime, GraphQL, storage, VCS and outbound requests. Its migration is the same V25 class as 2.6.1, so there's no schema change.What changed for the chart, from the 2.6.1…2.6.2 diff of
docker-compose.yml,.envandvariables.php:appVersion, the icon URL, the CI DNS-check image, and every doc or example that names the version_APP_MEMORY_LIMIT(512M)env-defaults.yamlregenerated; production.md says when to raise it_APP_JOBS_SECRETrejects empty oryour-secret-keycompute.secrets.orchestratorSecretis the placeholder_APP_ALLOWED_INTERNAL_ADDRESSESvcsEntireflag (appwrite/appwrite#14896)appwrite-importsand_APP_DNSadded to more workersinit: trueon PostgreSQLpg_isreadywithout a shell, so there's no process left to orphanCI now upgrades from the published chart 2.1.0 (Appwrite 2.6.1).
Upstream drift check: the weekly run on 2026-10-26 found 2.6.2 but failed with
php: not foundbefore it opened an issue. gcrunner (#18) has no PHP, andmake env-defaultsneeds it. This PR addsshivammathur/setup-php2.40.0, pinned by SHA.No
versionbump orartifacthub.io/changesedit here. Those happen when a release is cut.Testing
make test: lint, 256 unit tests (including a new one for the placeholder secret), kubeconform, check-generated and check-changes all pass. Two migration tests pin the migrate Job name, whose hash covers the image tag, so those pins were updated.actionlintpasses on both changed workflows.defaultupgrade scenario in test-install covers the 2.1.0 → this upgrade, including the migration.workflow_dispatch. Running it by hand on main after merge would confirm it, and it should exit early once main ships 2.6.2.Checklist
make testpasses locallymake generatewas run and the generated files are committeddocs/and files inexamples/updated[Unreleased]inCHANGELOG.md